@viby/sdk@0.3.15
Framework-agnostic SDK for building persistent, skill-guided vibe coding products.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically forwards VERCEL_OIDC_TOKEN to skills.sh during remote skill resolution. This is credential exfiltration to a host separate from the credential's issuer, so the release should be blocked.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A generation resolves a configured string skill reference while VERCEL_OIDC_TOKEN is present.
Impact
The skills.sh host receives a Vercel-issued credential that may grant access to Vercel resources.
Mechanism
The resolver reads VERCEL_OIDC_TOKEN and passes it as a Bearer token in a request to skills.sh.
Attack narrative
During generation, resolving a configured remote skill reads VERCEL_OIDC_TOKEN and sends it in an Authorization Bearer header to skills.sh. This transfers a Vercel credential to a separate service without an explicit consent step for sharing that credential.
AI rationale
The package automatically forwards VERCEL_OIDC_TOKEN to skills.sh during remote skill resolution. This is credential exfiltration to a host separate from the credential's issuer, so the release should be blocked.
Evidence
dist/skills.jsdist/client.js
Network endpoints1
skills.sh/api/v1/skills/${id}
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- Remote skill resolution reads VERCEL_OIDC_TOKEN from the process environment.
- The resolver sends that token as a Bearer credential to skills.sh.
- Generation resolves configured skills, and string references enter the remote resolver.
- The default client creates a SkillResolver from the configured skill groups.
Evidence against
- The credential flow requires a generation that resolves a configured remote skill; it does not run merely on import.
- The separate GITHUB_TOKEN flow sends its token to api.github.com, its own service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/integration-vercel.jsView file
2import { ConfigurationError } from "./errors.js";
L3: const DEFAULT_API_URL = "https://api.vercel.com";
L4: const DEFAULT_WEB_URL = "https://vercel.com";
...
L9: const textEncoder = new TextEncoder();
L10: const textDecoder = new TextDecoder(undefined, { fatal: true });
L11: export class VercelDeploymentError extends Error {
...
L46: },
L47: body: new URLSearchParams({ token: current.accessToken }),
L48: signal: context.signal,
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/integration-vercel.jsView on unpkg · L2dist/skills.jsView file
13backend: ["backend", "api", "server", "authentication", "session", "webhook"],
L14: data: ["database", "schema", "query", "postgres", "migration", "storage"],
L15: ai: ["ai", "agent", "model", "llm", "prompt", "embedding", "generation"],
...
L32: #cache = new Map();
L33: constructor(groups = {}, rootDirectory = process.cwd(), resolvers = []) {
L34: this.#groups = groups;
...
L69: for (const resolver of this.#resolvers) {
L70: const output = await resolver.resolve({ reference, category, prompt });
L71: if (output)
...
L235: async function resolveRemoteSkill(id) {
L236: const oidcToken = process.env.VERCEL_OIDC_TOKEN;
L237: if (oidcToken) {
High
Credential Exfiltration
Findings
1 Critical3 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/api-host.js
HighCredential Exfiltrationdist/skills.js
HighTrigger Reachable Credential Exfiltrationdist/skills.js
HighSemantic Analysis Limiteddist/deployment-preparation.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/integration-vercel.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @viby/sdk@0.3.15.
See all versions of @viby/sdk for other recorded verdicts.
- Avoid installing @viby/sdk@0.3.15. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.